|
GoodGuy -> RE: What's the best Virus protection program? (12/13/2009 2:16:20 PM)
|
quote:
ORIGINAL: LarryP
I used ZoneAlarm Pro for a couple of years and had nothing but troubles on two machines with different systems. Never again.
I guess you're still using Windows' firewall and nothing else?
Don't do that.
On a sidenote, until around 3 or 4 yrs ago, ZoneAlarm used to have a few security holes, in particular where ZA wouldn't report/deny outbound traffic from local services and/or apps. ShieldsUp and other pages reported about that. They (ZA) did do their homework, so it had been fixed a while ago.
I'm using a pretty old version (version 2.0.15A from 2001) of "Tiny Personal Firewall", which is an ultra-light firewall. It's almost impossible to find this particular version, so the usual version still floating around (eg. here: http://www.pctipp.ch/downloads/internet/23786/tiny_personal_firewall.html) may be 2.1.15 .
Both versions also have a port monitor (right-click -> "FW status window") showing all opened connections on your computer ["localhost"], and even tasks that are "listening" on say port 135. Geez, that reminds me of having to close that sucker. If I could only remember how, now hahaha, hmmm might deal with alg.exe . Oh well, that happens if your brain has to memorize a shytload of tweaks in order to make things safer these days.[:D]
Anyway, so this port monitor is almost as good as a stand-alone monitor (eg. "ActivePorts").
Tiny also disables and blocks NetBIOS (packets), which can be used to gain remote access.
Kerio Personal Firewall isn't a bad FW either, actually they tried to include a warning list, and a more simplified approach for less tech savyy people (like in Zone Alarm), while keeping a lightweight structure. Actually, although KerioPF used to be based on the same engine as TPF, newer versions may not have the possibility to restrict apps to certain ports (say firefox to port 80), and I really need/want that feature. It also adds another level of security.
Quite some trojans edit the registry to disable common firewalls. The user won't figure it, as often the icons in the system tray are still active/visible.
There's a neat registry entry you can add to avoid that, and it should work for both, TPF and (older?) versions of KPF (in cases where Kerio uses the same driver/entry "fwdrv")
Under:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\fwdrv
just add a new D-Word and name it "AlwaysSecure" (without the ""), then double-click on the new parameter and set it to 1 (decimal).
This will cause your system to shut down the internet connection the second you shut down your firewall engine/driver (or if it had been disabled by a trojan/virus). If you use that switch, it will be active on next reboot. Deleting the D-Word entry or setting the value to 0 (ZERO = off, 1 = on) will disable that feature.
EDIT: I didn't use this registry switch before .... but I just added it, rebooted, and wow, that's neat. Although the DSL status window is still visible, the connection is dead after I shut down the Firewall. Nice ! Trojan programmers can change the value, but this entry shouldn't be targeted by too many hackers, as the FW is old and not really common anymore. [:D]
I prefer such dino firewalls to recent "hightech" firewalls, as you are actually the boss, and not some halfassed automated rule-settings thingy.
I recommend that you try tiny personal FW. My old version works on XP like a charm, I'm not 100% sure about 2.1.15.
There is a rare chance that you get a bluescreen (I think it used to deal with XP's SP1 or SP2) , if so you'd have to uninstall it and switch to my version. I could send it to you, if you can't find it, so you could give it a try.
Btw, you should know a little bit about the basics regarding ports and system processes, before using such "simple" but effective firewalls, but ShieldsUp and Google should provide sufficient info, in case a port or EXE file catches your attention.
Since you said you printed out my collection of tips, I'd say such a lightweight fw should work out for you. Once you've created a few rules (you get popups for each and every access to the internet until you have set say 5 or 10 rules, which is easy) the fw won't bother you anymore, as you will "just" get a few popups once in a while when hackers or automated trojan/worm routines try to attack your computer. You create a rule and deny such attempts, and for outgoing connections you may have to evaluate if you really need that particular service/application to access the net, once in a while.
With this type of firewall, you'll get to know (and you'll be surprised) more about what apps (and what ports) are trying to access the net, as nothing is automated, except for the enforcement of the rules you set.
HOI III's launcher for example tries to connect to a server when you get to the launcher screen, and it will display an Internet Explorer page (funny I am using firefox exclusively) "this page cannot be displayed", if you don't permit the launcher to establish an outgoing connection. If you're offline, the launcher will display the proper image.
A tiny lesson on how to use such ultra-light but powerful firewalls:
- Deny (check "Create appropriate filter rule" and hit DENY) incoming or outgoing requests dealing with the "Generic Host Process".
- Deny incoming + outgoing ICMP Echo Requests and IMCP Echo Replies, so hackers/port scanners will think your IP is dead (or firewalled), means they can't PING your computer anymore. Deny any "incoming ICMP".
- Deny incoming or outgoing connections trying to access "SYSTEM" on your puter. Create a rule (just check the "Create filter rule" option and hit DENY.
- Reduce access of typical internet apps: eg. Firefox usually only needs to access port 80 and 443 (for SSL secure connections), for outgoing TCP connections. No other ports, NO incoming connection and no UDP protocol needed.
Check "Create filter rule", then click on "customize rule".
For such outgoing connections, the local endpoint isn't important (and may vary each time an app tries to access the net), but the remote point's port number: Don't touch the radio button for the IP address, as you don't want to apply the rule to one IP only (in this case at least), then just switch from "Create rule for any remote port" to "Create rule for this remote port only" (say 443 or 80) and hit okay. The neat thing here is that TFP will give you the number of the port each time, so you actually get to know what app is using what port (and what's going on on your system). Once back on the "Outgoing Connection Alert" window, you just hit PERMIT.
- Install XP-AntiSpy and go through the settings/switches. Using AntiSpy (and setting most of the offered options) will reduce Windows' attempts to "phone home" (ET-style, to Microsoft in this case heheh) to ZERO. It will also turn off bubbles and hints, and - really important - cut MediaPlayer's habit to install (potentially malicious) codecs and DRM without asking the user, as this can't be blocked by a firewall.
- With all other connection alerts, just go with common sense and check WHO or WHAT is trying to establish an outbound/inbound connection, means keep an eye on the application's name and port, and hit DENY if you're not sure what it is.
Just check "create rule" and hit DENY and the Firewall won't bother you again. In turn, if you create a rule and hit PERMIT, then make sure you KNOW what application will get a permit. All firewalls depend on the user's level of attention/knowledge.
If an incoming request tries to access let's say firefox on a port other than 80 or 443, without you having clicked on any link, then there is a chance that someone tries to exploit one of those 80! medium risk security holes in FF (rated indeed as medium risks by experts, IE has less than 40 these days), and there's still a tiny chance that it could be some way of pulling data streams to your puter (like for advertizing or video streams), too.
But in general, even these kinda connections can be established on port 80, and there's usually NO reason to have a site push content/data to your puter (which you'd then notice as incoming connection alert in your firewall), respectively your browser.
- All incoming connections on Windows' service ports (port 1024 and below) and "destination unreachable" Firewall events should make you suspicious and double check what's going on. Same with the usual suspects like port 135, 53, 35 for outgoing/incoming connections. Read up on the webby ShieldsUp and other sites why you should watch and deny access to these ports.
|
|
|
|
